forked from cattle-ops/terraform-aws-gitlab-runner
-
Notifications
You must be signed in to change notification settings - Fork 0
/
security_groups.tf
210 lines (173 loc) · 6.4 KB
/
security_groups.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
########################################
## Gitlab-runner agent security group ##
########################################
resource "aws_security_group" "runner" {
name_prefix = local.name_sg
vpc_id = var.vpc_id
description = var.gitlab_runner_security_group_description
dynamic "egress" {
for_each = var.gitlab_runner_egress_rules
iterator = each
content {
cidr_blocks = each.value.cidr_blocks
ipv6_cidr_blocks = each.value.ipv6_cidr_blocks
prefix_list_ids = each.value.prefix_list_ids
from_port = each.value.from_port
protocol = each.value.protocol
security_groups = each.value.security_groups
self = each.value.self
to_port = each.value.to_port
description = each.value.description
}
}
tags = merge(
local.tags,
{
"Name" = format("%s", local.name_sg)
},
)
}
########################################
## Security group IDs to runner agent ##
########################################
# Allow ICMP traffic from allowed security group IDs to gitlab-runner agent instances
resource "aws_security_group_rule" "runner_ping_group" {
count = length(var.gitlab_runner_security_group_ids) > 0 && var.enable_ping ? length(var.gitlab_runner_security_group_ids) : 0
type = "ingress"
from_port = -1
to_port = -1
protocol = "icmp"
source_security_group_id = element(var.gitlab_runner_security_group_ids, count.index)
security_group_id = aws_security_group.runner.id
description = format(
"Allow ICMP traffic from %s to gitlab-runner agent instances in group %s",
element(var.gitlab_runner_security_group_ids, count.index),
aws_security_group.runner.name
)
}
########################################
## Docker-machine security group ##
########################################
resource "aws_security_group" "docker_machine" {
name_prefix = "${local.name_sg}-docker-machine"
vpc_id = var.vpc_id
description = var.docker_machine_security_group_description
dynamic "egress" {
for_each = var.docker_machine_egress_rules
iterator = each
content {
cidr_blocks = each.value.cidr_blocks
ipv6_cidr_blocks = each.value.ipv6_cidr_blocks
prefix_list_ids = each.value.prefix_list_ids
from_port = each.value.from_port
protocol = each.value.protocol
security_groups = each.value.security_groups
self = each.value.self
to_port = each.value.to_port
description = each.value.description
}
}
tags = merge(
local.tags,
{
"Name" = format("%s", local.name_sg)
},
)
}
########################################
## Runner agent to docker-machine ##
########################################
# Allow docker-machine traffic from gitlab-runner agent instances to docker-machine instances
resource "aws_security_group_rule" "docker_machine_docker_runner" {
type = "ingress"
from_port = 2376
to_port = 2376
protocol = "tcp"
source_security_group_id = aws_security_group.runner.id
security_group_id = aws_security_group.docker_machine.id
description = format(
"Allow docker-machine traffic from group %s to docker-machine instances in group %s",
aws_security_group.runner.name,
aws_security_group.docker_machine.name
)
}
########################################
## Security groups to docker-machine ##
########################################
# Combine runner security group id and additional security group IDs
locals {
# Only include runner security group id and addtional if ping is enabled
security_groups_ping = var.enable_ping && length(var.gitlab_runner_security_group_ids) > 0 ? concat(var.gitlab_runner_security_group_ids, [aws_security_group.runner.id]) : []
}
# Allow SSH traffic from gitlab-runner agent instances and security group IDs to docker-machine instances
resource "aws_security_group_rule" "docker_machine_ssh_runner" {
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
source_security_group_id = aws_security_group.runner.id
security_group_id = aws_security_group.docker_machine.id
description = format(
"Allow SSH traffic from %s to docker-machine instances in group %s on port 22",
aws_security_group.runner.id,
aws_security_group.docker_machine.name
)
}
# Allow ICMP traffic from gitlab-runner agent instances and security group IDs to docker-machine instances
resource "aws_security_group_rule" "docker_machine_ping_runner" {
count = length(local.security_groups_ping)
type = "ingress"
from_port = -1
to_port = -1
protocol = "icmp"
source_security_group_id = element(local.security_groups_ping, count.index)
security_group_id = aws_security_group.docker_machine.id
description = format(
"Allow ICMP traffic from %s to docker-machine instances in group %s",
element(local.security_groups_ping, count.index),
aws_security_group.docker_machine.name
)
}
########################################
## Docker-machine instances to self ##
########################################
# Allow docker-machine traffic from docker-machine instances to docker-machine instances on port 2376
resource "aws_security_group_rule" "docker_machine_docker_self" {
type = "ingress"
from_port = 2376
to_port = 2376
protocol = "tcp"
self = true
security_group_id = aws_security_group.docker_machine.id
description = format(
"Allow docker-machine traffic within group %s on port 2376",
aws_security_group.docker_machine.name,
)
}
# Allow SSH traffic from docker-machine instances to docker-machine instances on port 22
resource "aws_security_group_rule" "docker_machine_ssh_self" {
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
self = true
security_group_id = aws_security_group.docker_machine.id
description = format(
"Allow SSH traffic within group %s on port 22",
aws_security_group.docker_machine.name,
)
}
# Allow ICMP traffic from docker-machine instances to docker-machine instances
resource "aws_security_group_rule" "docker_machine_ping_self" {
count = var.enable_ping ? 1 : 0
type = "ingress"
from_port = -1
to_port = -1
protocol = "icmp"
self = true
security_group_id = aws_security_group.docker_machine.id
description = format(
"Allow ICMP traffic within group %s",
aws_security_group.docker_machine.name,
)
}